FCP-FortiGate 7.6 Administrator Training Part 1/2

Learn to download and install eve-ng community edition 6.204 on vmware workstation pro, configure hardware and networking, and access the web interface from a browser.

Upload Cisco IOL switches to EVE-NG via FTP, download and extract images, apply the license file, then configure layer 2 or layer 3 as needed and verify with show commands.

Learn how to upload ready-made lab images to eve ng or ifeng using sftp, including Fortigate 7.6, Kali Linux, Ubuntu Server, Pfsense, and Windows images.

Download the Fortigate image from Fortinet, unzip it, and upload it to Ifeng on eve-ng. Create a Fortinet/version/build folder, rename the file, apply permissions, and deploy Fortigate 763.

demonstrates how to add a FortiAnalyzer image to Eve-NG from scratch, including download, directory setup, dual hard drives, permissions, and RAM configuration for lab use.

Download the latest Kali Linux 2025 qcow2 image, extract with seven zip, and rename it for EVE-NG; then upload to EVE-NG community edition and start the virtual machine.

Set up the FortiGate administrator lab topology in eve-ng to practice routing, security profiles, VPN, and zone-based segmentation across LAN, DMZ, WAN, and management with two ISPs.

Export a readymade lab topology from LNG, then import it into the EVE-NG community edition, configure connectivity with a management cloud, and align images and Fortigate versions for practice.

Configure pcs in the lab and remote and external machines with static ipv4 addresses, subnet mask, gateway, and dns; disable ipv6 and windows firewall, set time zones, and verify connectivity.

Configure lab servers (server one and server two) with static IPs, netmask, and gateway; set hostnames and basic web configurations to verify FortiGate lab readiness.

Execute the initial Active Directory configuration on Windows Server 2019, configuring network settings, DNS and DHCP roles, time zone, remote desktop, disabling firewall and real-time protection, and renaming the server.

Install and configure Active Directory Domain Services on Windows Server 2019. Promote the server to a domain controller for a new forest, test.local, including DNS and prerequisite checks.

Configure dns on Windows Server 2019 as a prerequisite for active directory by creating forward and reverse zones. Add host pointers for firewall1 and firewall2 and validate using nslookup.

Demonstrate creating users and groups in active directory, including air, it, admin, and support groups, assign users to groups, and apply lab password with never expire and cannot change settings.

Configure Windows server 2019 as an ntp server using group policy, enable Windows time server, adjust announce flag, and ensure the time service is running, then verify with ntp tool.

Learn how FortiGate factory default settings vary by model and firmware, including management ports, default management IP 192.168.1.99/24, admin login with no password, and reset options via CLI or GUI.

Configure FortiGate 7.6 firewall FW1 with initial settings, including hostname, management interface IP on port five, and enabling https, http, ssh, and ping. Includes license options and initial login.

Explore four access methods for Fortigate firewall: graphical user interface, command line interface, application programming interface, and 40 manager for easy management, quick configuration, and automation.

Navigate the FortiGate firewall dashboard to view device details, use the left menu and search to switch pages, manage widgets, and access cli, diagnostics, backups, and firmware.

Create your own FortiGate dashboard by adding widgets for DHCP, DNS, SD-WAN, administrator status, CPU usage, and sessions, then resize, drag and drop, and save as a favorite.

Explore how Fortigate widgets on the status dashboard enable quick actions and dynamic monitoring. Drag, resize, and customize widgets for network, SD-WAN, IPsec, and DNS insights.

Explore FortiGate firewall monitor, comparing 40 view and non 40 view monitors and drill down into sources, destinations, apps, policies, and sessions to manage policies.

Explore how to reset or switch Fortigate firewall dashboard templates, from the lean optimal view to the comprehensive one, enabling quick health checks or deep monitoring.

Explore the Fortigate firewall CLI structure, from command to subcommand, object, table, field, option and value, and learn to configure interfaces and an IP address via config and show commands.

Master Fortigate CLI keyboard shortcuts to navigate the firewall command line: use question mark and tab for command completion, plus ctrl keys for cursor movement, editing, history, and screen clearing.

Learn to perform Fortigate firewall fw1 system configuration by setting dns, time zone, and ntp via gui and cli; verify with get system dns and show system status.

Learn how Fortigate interfaces use role and alias to define purpose and simplify management. Role impacts policy and visibility, while alias provides a custom label for identification in complex networks.

Configure FortiGate interfaces by assigning alias, role, ip address, subnet mask, and admin access; set port roles: 1–2 isp, 3 lan, 4 dmz, with management access.

Configure Fortigate administrative access to control login methods (https, ssh, http, telnet) and show how graphical user interface and command line interface enable or restrict these, securing management on interfaces.

Explore how routing protocols like RIP, OSPF, and BGP direct traffic between routers and how routed protocols carry user data such as email, websites, and files using IPv4 and IPv6.

Understand static routing, where admins manually set routes for small networks with infrequent changes, noting admin distance and priority, default routes, and Fortigate firewall configuration.

Administrative distance determines the best path when routes duplicate; lower values mean more reliable sources, with direct connections at zero and protocols like rip 20, ospf 110, ibgp 200.

Learn how route priority acts as a tiebreaker for static routes with equal administrative distance, and how FortiGate picks the best route by lowest distance then lowest priority.

Learn how route metrics guide best-path selection within routing protocols, with examples like OSPF cost, RIP hop count, and BGP path count, and distinguish metrics from administrative distance.

Configure static and default routes on a FortiGate firewall, verify routes via dashboard and CLI, and manage gateways 1.254 and 2.254 with admin distance and priority.

Configure a FortiGate primary and backup path with static routes, using different administrative distance or priority to enable automatic failover and route health monitoring for SD-WAN and IMP.

Configure primary and backup routes on Fortigate using two static routes with different administrative distance or priority for automatic failover and verification via the command line interface and dashboards.

FortiGate's equal cost multipath load balances traffic across multiple routes to the same destination, using policy routes, link health monitor, and methods such as source IP, weight, and usage base.

Configure and verify ECMP on Fortigate 7.6, align administrative distance and priority for equal-cost paths, switch to source-destination mode, and test failover and routing table updates.

Explore ECMP load balancing methods in a FortiGate lab, comparing source IP base, weight base, usage base, and source-destination IP base, with spillover thresholds and health monitoring.

Learn how Fortigate's link health monitor checks wan interfaces, pings gateways, and automatically switches to a backup link by removing failed static routes and re-adding them when the primary recovers.

Configure health link monitor via CLI to detect ISP failures and switch between primary and backup links, using ping targets, intervals, and fail/recovery times.

Explore Fortigate policy routing to divert traffic from the default static route using source, destination, protocol, port, and interface conditions, selecting different gateways or ISPs.

Configure policy routing on a FortiGate firewall to direct PC1 and PC2 traffic to dedicated gateways. Verify the policy routes take precedence over static routes.

Discover how to configure static routes with name addresses on Fortigate, by creating firewall address objects and using them as static route destinations after enabling routing configuration.

Configure a static route with name addresses on a FortiGate firewall by creating an address object and enabling routing configuration, then verify traffic flow via routing table and logs.

Explore Fortigate internet services routing using the ISDB to route traffic by service name; apply ISDB to static routes for policy-based traffic control.

Configure internet services routing on a FortiGate firewall using static and policy routes, selecting services from the internet services database and testing ICMP to verify the policy path.

Explore how FortiGate uses a rib to store routing information base and a fib to forward packets, with a route cache for decisions. Read rib and fib details via cli.

Configure the dmz switch: create vlan 20 and 30 for two servers, assign 0/1 and 0/2 to these vlans, and enable trunk on 0/0 to the firewall.

Configure vlan based dmz networking on FortiGate by creating vlan 20 and vlan 30 subinterfaces for srv1 and srv2, assign ips, and implement firewall policies to internet with ping verification.

Configure zone-based security on Fortigate by converting VLANs to a DMZ zone, linking interfaces, and creating a single allow policy from the DMZ zone to the internet.

Learn how FortiGate NAT translates private IPs to a public IP, saving IPv4 space, hiding internal addresses for security, and supporting source and destination NAT with policy or central NAT.

Explore FortiGate NAT types, including source net, destination net, policy based net, central net, static and dynamic nets, port address translation, and virtual IP with port forwarding.

Learn how source network address translation (xnet) hides internal ips by translating them to the Fortigate's public ip for outbound traffic. Explore static, dynamic, and central net configurations.

Configure policy source interface overload (static net) by translating internal traffic to the firewall’s outside IP 192.168.1.1, then verify with system session lists and dashboard.

Configure a policy source overload net inside a policy by creating a dynamic IP pool, assigning an external range, and validating with session lists and forwarding traffic.

Configure policy source 1 to 1 net as a dynamic net, create an IP pool for range 110 to 111, and note only two PCs can use it concurrently.

Configure a policy source fixed port range net within a dynamic net, defining an internal IP range and a 120–121 port pool; verify with ping, sessions, and logs.

Configure a FortiGate NAT lab to allocate source port blocks for dynamic nets, create an IP pool, apply port block allocation in policies, and verify with logs.

Enable central source net in system settings, then configure centralized source nets with outgoing interface IP, creating net policies checked top to bottom and verified in firewall logs.

explore destination net translation on FortiGate, changing the destination IP and port, and map public to internal servers with static VIP, VIP with services, and port forwarding.

Configure destination net on a Fortigate firewall using virtual ip and static net. Map external ip to internal 10.0.2.1 and expose http and https through a dmz firewall policy.

Configure destination net port forwarding by mapping external port 8080 to internal port 80 for server two (10.0.3.2) via a DMZ VIP, and verify with logs and CLI.

Learn to configure virtual IP without central source net on FortiGate 7.6, convert nets to virtual IP, adjust firewall policies, and verify DMZ traffic via CLI and logs.

Fortigate firewall policies serve as the core mechanism to allow or deny traffic by matching top to bottom rules against source, destination, interfaces, service, and schedule, ending with implicit deny.

Configure Fortigate firewall policy parameters, including interfaces, source and destination addresses, users, services, schedules, and security profiles, to control bidirectional traffic and apply the implicit deny default.

Compare per policy flow base and proxy base inspection modes on Fortigate, highlighting flow base's real-time, high-throughput processing and proxy base's deeper content scanning and buffering.

Enable multiple interface policies and any policies in FortiGate by turning on system feature visibility, then apply and use multiple interfaces and any in firewall policies.

Learn FortiGate firewall policy configuration by building a lab to block China, Iran, and Russia traffic, enable DNS and Active Directory access, and configure DMZ to internet with implicit deny.

Explore the fortigate firewall policy table to learn how ids, policy names, from interfaces, to interfaces, sources, destinations, schedules, services, nat, utm profiles, and logs govern traffic.

Use policy match to identify which firewall policy applies to traffic by entering the interface, protocol, IP address, and source and destination ports, then view the matching policy and action.

Explore how FortiGate's policy view lets administrators manage firewall rules across interface pair, by sequence, or by grouping, with options to edit, move by ID, copy, and view logs.

Enable the firewall policy logging option by default and choose between security events logs and all session logs for visibility; generate logs when sessions start for real-time monitoring and troubleshooting.

Master FortiGate firewall policy management by customizing policy tables, adding and removing columns, and applying filters. Learn to copy, paste, edit, search, and view matching logs across different policy views.

Create a local user and a group to enforce a user-based firewall policy on FortiGate, restricting internet access with authentication and monitoring via logs and dashboards.